ping_scan_int-ext
Explanation
ping_scan_int-ext is a security event in the Netography Fusion Portal that looks for Internal to External Ping Scans.
What to Look For
If ping_scan_int-ext is triggered, it means that an internal host within your network is attempting to ping external IP addresses. This is a potential sign of an attacker attempting to map out your network and identify potential targets for further exploitation. Look for abnormal ping activity from internal hosts and investigate any suspicious traffic from those hosts. It may also be indicative of an infection, or a misconfiguration in a network scanning or mapping tool.
Related MITRE ATT&CK Categories
Updated 20 days ago